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DETAILED ACTION 



1. 



This Office Action is in response to the amendment filed 10/18/04. 



2. 



Claims 1, 25, 26, 34, 55 and 62-64 were amended. 



3. 



Claims 1-4 and 6-64 are pending in this Office Action. 



Response to Amendment 



4. The objection to the Oath/Declaration stands. 

5. The objection to Claim 55 is withdrawn. 

6. The rejections of Claim 62-65 under 35 U.S.C. §112, second paragraph, are with 
drawn. 

7. Applicant's arguments with respect to Claims 1 and 34 have been considered but are 
moot in view of the new ground(s) of rejection. 

8. Applicant's remaining arguments have been fully considered but they are not 
persuasive. 

9. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. 



10. Applicant believes a new oath is not required as the correct priority date is listed in 
the first paragraph of the specification and that identification of the U.S. provisional 
application in the oath or declaration is not required by 37 CFR 1.63. Regardless of such, 
Applicant has chosen to include such information in the Oath/Declaration along with the 
statement that all statements made within the Oath/Declaration are true. This is obviously 
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not the case as there is a clear inaccuracy with the U. Supplication filing date. As such, a 




supplemental oath (see 37 CFR 1 .67) is required to either correct or remove the U.S. 

provisional application information. 

37 CFR 1 .67. Supplemental oath or declaration. 

(a) The Office may require, or inventors and applicants may submit, a 
supplemental oath or declaration meeting the requirements of § 1 .63 or § 1 .162 to 
correct any deficiencies or inaccuracies present in the earlier filed oath or 
declaration. 



1 1 . The following is a quotation of the first paragraph of 35 U.S.C. 112: 

The specification shall contain a written description of the invention, and of the manner and process of 
making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to 
which it pertains, or with which it is most nearly connected, to make and use the same and shall set forth the 
best mode contemplated by the inventor of carrying but his invention. 

12. Claims 1 is rejected under 35 U.S.C. 112, first paragraph, as failing to comply with 
the written description requirement. The claim(s) contains subject matter which was not 
described in the specification in such a way as to reasonably convey to one skilled in the 
relevant art that the inventor(s), at the time the application was filed, had possession of the 
claimed invention. Claim 1 states the limitation "monitoring transport layer network 
communications". In regards to monitoring, the specification does not describe the 
monitoring of any one particular layer. On page 4, lines 11-12, the specification describes 
software that allows "for monitoring and storing raw TCP/IP data". On page 3, lines 1-2, the 
specification states, "The present invention monitors all Transport Control Protocol/Internet 
Protocol (TCP/IP)'network communications." TCP/IP is also known as the Internet protocol 
suite since the protocols making up the suite commonly implement the protocol stack on 



Claim Rejections - 35 USC §112 
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which the Internet runs. The protocols of TCP/IP function across the different layers of the 
stack. However,, the specification does not specifically describe monitoring the transport 
layer network communications or any layer in particular. Therefore, Claim 1 fails to comply 
with the written description requirement. 

13. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

14. Claims 1 and 34 rejected under 35 U.S.C. 112, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

15. Both claims 1 and 34 include the limitation "half sessions". This limitation is 
described in relation to network data or communications. The examiner is not sure as to 
how the Applicant defines a "half session" as the specification lacks a definition, either 
explicit or implied/ in regards to this terminology. The specification only states, on page 4, 
lines 14-15, "During monitoring and storing, the program listens to the Ethernet interface in 
promiscuous mode, storing each TCP/IP half-session to its own file or log on disk." 
(emphasis added). Typically, a "half-session" is related to an IBM proprietary 
communication protocol called Systems Network Architecture (SNA) as well as IBM's 
Information Management Systems (IMS). In relation to SNA, a "half-session" basically 
describes a program or terminal that makes up part of a session. The instant application 
does not seem to be related to such a definition. Another similar term is a "half-open" 
session or a "TCP half session". These relates to a TCP session where one side of the 
connection is closed without the knowledge of the other side knowing. Particularly, a "TCP 
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half session" is where the server receives a SYN from a client and responds with the 
SYN_ACK, but never receives the ACK back from the client. This usually relates to 
discussions of SYN attacks. The instant application does not seem to be related to these 
terms either. As such, claims 1 and 34 fail to particularly point out and distinctly claim this 
subject matter and are therefore indefinite-. For purpose of rejection, the examiner will 
consider "half sessions" to be part of network communications that are incoming 
communications (the incoming "half of a communication session). 

Claim Rejections - 35 USC § 102 

16. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form 
the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another 
filed in the United States before the invention by the applicant for patent or (2) a patent granted on an 
application for patent by another filed in the United States before the invention by the applicant for patent, 
except that an international application filed under the treaty defined in section 351(a) shall have the effects 
for purposes of this subsection of an application filed in the United States only if the international application 
designated the United States and was published under Article 21 (2) of such treaty in the English language. 

17. Claims 34-35, 37-39, 44, 47-50, 52-55, 57, 58 and 60-64 are rejected under 35 
U.S.C. 102(e) as being anticipated by U.S. Patent 6,266,664 by Russell-Falla et al. 
(Russell-Falla). 

18. With respect to Claim 34, Russell-Falla teaches a method for monitoring and 
maintaining an acceptable use policy for computer network usage (Col. 1 lines 26-34) 
comprising: a. capturing data on a network (Col. 4 line 61 - Col. 5 line 4) wherein the data 
comprises multiple half sessions (Col. 4 Iine61 - Col. 5 line 4, As noted above, the examiner 
interprets "half sessions" to be part of network communications that are incoming 
communications) of transport layer network communications (It is inherent that any network 
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communication data on a network such as the Internet/Web -Col. 4 line 61 - Col. 5 line 21 
and Col. 1 lines 37-45 - would comprise multiple half sessions of transport layer network 
communications); b. removing data content that does not contain language elements (Col. 5 
lines 5-11); c. testing the remaining content for the presence of predetermined expressions 
(Col. 5 lines 5-1 1 ); d. maintaining a sum of values associated with said predetermined 
expressions found within at least one category (Col. 3 line 65 - Col. 4 line 3); e. storing the 
remaining data if the sum of values associated with said predetermined expressions within 
a category meets or exceeds a threshold value (Col. 5 lines 47-64 and Col. 6 lines 29-34). 

19. With respect to Claim 35, Russell-Falla teaches all the limitations of Claim 34 and 
further teaches the computer network is a wide area network (Col. 1 lines 37-45 of Russell- 
Falla). 

20. With respect to Claim 37, Russell-Falla teaches all the limitations of Claim 34 and 
further teaches the computer network is aTCP/IP network (Col. 1 lines 37-45 of Russell- 
Falla). 

21 . With respect to Claim 38, Russell-Falla teaches all the limitations of Claim 34 and 
further teaches said expressions are weighted (Col. 3 lines 55-67 of Russell-Falla). 

22. With respect to Claim 39, Russell-Falla teaches all the limitations of Claim 38 and 
further teaches said expressions are weighted with either positive or negative values (Col. 3 
line 60 - Col. 4 line 3 of Russell-Falla). 

23. With respect to Claim 44, Russell-Falla teaches all the limitations of Claim 34 and 
further teaches said expressions are regular expressions (Col. 3 lines 1-6 of Russell-Falla). 
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24. With respect to Claim 47 f Russell-Falla teaches all the limitations of Claim 35 and 
further teaches said threshold value for a category is variable (Col. 5 lines 47-63 of Russell- 
Falla). 

25. With respect to Claim 48, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches outputting a report relating to the presence of predetermined expressions 
(Col. 6 lines 29-34 of Russell-Falla). 

26. With respect to Claim 49, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches said report identifies individuals whose use of the computer network 
included communications which matched predetermined expressions (Col. 6 line 29-34, 
note the functionality of the report in Russell-Falla is tied to a user - Col. 6 lines 15-21 of 
Russell-Falla). 

27. With respect to Claim 50, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches said report identifies network addresses where communications were 
received or originated that included matched predetermined expressions (Col. 6 lines 29-34 
of Russell-Falla). • 

28. With respect to Claim 52, Russell-Falla teaches all the limitations of Claim 50 and 
further teaches said report is in a graphical format (Col. 9 lines 1-8 of Russell-Falla). 

29. With respect to Claim 53, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches said report provides the text of all communications that match said 
preselected criterion (Col. 6 lines 29-34 of Russell-Falla). 

30. With respect to Claim 54, Russell-Falla teaches all the limitations of Claim 48 and 
further teaches said report is human readable format (Col. 6 lines 29-34 of Russell-Falla). 
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31 . With respect to Claim 55, Russell-Falla teaches a method for monitoring and 
maintaining an acceptable use policy for computer network usage (Col. 1 lines 26-34) 
comprising: a. capturing data on a network (Col. 4 line 61 - Col. 5 line 4); b. removing data 
content that does not contain language elements (Col. 5 lines 5-11); c. defining categories 
(Col. 4 lines 45-67) with weighted predetermined expressions (Col. 3 lines 36-51); c. testing 
the remaining content for the presence of predetermined expressions (Col. 5 lines 5-11); d. 
maintaining a sum of values associated with said predetermined expressions found within 
each category (Col. 3 line 65 - Col. 4 line 3); e. storing the remaining data if the sum of 
values associated with said predetermined expressions present within a category exceeds a 
threshold value (Col. 5 lines 47-64 and Col. 6 lines 29-34). 

32. With respect to Claim 57, Russell-Falla teaches all the limitations of Claim 55 and 
further teaches the threshold value for a category is defined as the presence of no 
predetermined expressions (Col. 5 lines 47-64). 

33. With respect to Claim 58, Russell-Falla teaches all the limitations of Claim 55 and 
further teaches the computer network is a wide area network (Col. 1 lines 37-45). 

34. With respect to Claim 60, Russell-Falla teaches all the limitations of Claim 55 and 
further teaches the computer network is a TCP/IP network (Col. 1 lines 37-45). 

35. With respect to Claim 61 , Russell-Falla teaches all the limitations of Claim 55 and 
further teaches outputting a report relating to the presence of predetermined expressions 
whose sum meets or exceed the threshold value of a category (Col. 6 lines 29-34). 

36. With respect to Claim 62, Russell-Falla teaches all the limitations of Claim 61 and 
further teaches said report identifies individuals whose use of the computer network 
included communications which contained predetermined expressions whose sum matched 
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or exceeded the threshold value of at least one category (Col. 6 line 29-34, note the 
functionality of the report in Russell-Falla is tied to a user - Col. 6 lines 15-21). 

37. With respect to Claim 63, Russell-Falla teaches all the limitations of Claim 61 and 
further teaches said report identifies network addresses where communications were 
received or originated that included predetermined expressions whose sum matched or 
exceeded the threshold value of at least one category (Col. 6 line 29-34). 

38. With respect to Claim 64, Russell-Falla teaches all the limitations of Claim 63 and 
further teaches said report is in a graphical format (Col. 6 lines 29-34 and Col. 9 lines 1-8). 

Claim Rejections - 35 USC § 103 

39. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art 
are such that the subject matter as a whole would have been obvious at the time the invention was made to 
a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

40. Claims 1-4, 6, 7, 11-13, 15-21, 23, 27-29, 32 and 33 are rejected under 35 U.S.C. 
103(a) as being unpatentable over U.S. Patent 6,266,664 by Russell-Falla et al. (Russell- 
Falla) in view of U.S. Patent 6,453,345 by Trcka et al. (Trcka). 

41 . With respect to Claim 1 , Russell-Falla teaches in a computer network, a method of 
maintaining an acceptable use policy (Col. 1 lines 26-34) comprising: monitoring network 
communications (Col. 4 line 61 - Col. 5 line 4); wherein each network communication 
comprises multiple half sessions (Col. 4 Iine61 - Col. 5 line 4, As noted above, the examiner 
interprets "half sessions" to be part of network communications that are incoming 
communications); storing at least some of said half sessions (Col. 5 line 1-4); testing the 
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stored communication for the presence of at least one preselected criterion (Col. 5 lines 5- 
12); deleting the communication if the presence of said at least one preselected criterion is 
not determined (it is inherent that the communication will be forwarded to the web browser 
and deleted from testing function of the proxy server when the presence is not determined - 
Col. 5 lines 1-14 and lines 47-65); and storing the communication if the presence of said at 
least one preselected criterion is determined (Col. 6 lines 29-34 and Col. 9 lines 1-8). While 
Russell-Falla teaches the principles of the invention may be applied to other types of digital 
information and protocols (Col. 5 lines 36-48), Russell-Falla is silent as to implementation at 
particular network layers and unknown protocols. As such, Russell-Falla does not explicitly 
disclose monitoring transport layer network communications, and storing half sessions on 
disk even when the communication does not conform to a known protocol. Trcka teaches 
monitoring and capturing all raw network data packets (Col. 6 lines 1-25). Since all raw 
network data packets are captured, this would include those of unknown protocol. These 
raw network data packets are stored on disk (Col. 7 lines 13-27). By capturing raw network 
data packets, the invention of Trcka is capable of monitoring network communications at 
any network layer including any protocol functioning at that layer (Col. 7 lines 28-41, Col. 7 
line 49 - Col. 8 line 4 and Col. 18 lines 15-29). This would include the transport layer. It 
would have been obvious to one of ordinary skill in the art at the time the invention was 
made to take the method disclosed by Russell-Falla and modify it as indicated by Trcka 
such that the method further comprises monitoring transport layer network communications, 
wherein each network communication comprises multiple half sessions and storing at least 
some of said half sessions on disk, even when the communication does not conform to a 
known protocol. One would be motivated to have this, as it beneficial to network analysis 



Application/Control Number: 09/759,089 Page 1 1 

Art Unit: 2155 

and troubleshooting tasks and is further advantageous over existing network security 
systems (Col. 1 line 41 - Col. 2 line 9 and Col. 2 lines 49-65 of Trcka). 

42. With respect to Claim 2, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches the preselected criterion comprises one or more subject matter 
categories (Col. 4 lines 45-60 of Russell-Falla). 

43. With respect to Claim 3, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches at least some of said subject matter categories comprise 
regular expressions (Col. 3 lines 1-5 of Russell-Falla). 

44. With respect to Claim 4, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 3 and further teaches said regular expressions are weighted (Col. 3 lines 1-9 of 
Russell-Falla). 

45. With respect to Claim 6, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches the preselected criterion is weighted (Col. 3 lines 1-9 of 
Russell-Falla). 

46. With respect to Claim 7, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 4 and further teaches said regular expressions are weighted with either positive or 
negative values (Col. 3 line 60 - Col. 4 line 3 of Russell-Falla). 

47. With respect to Claim 1 1 , Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches the computer'network is a TCP/IP network (Col. 1 lines 37-45 
of Russell-Falla). . 

48. With respect to Claim 12, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches the computer network is a wide area network (Col. 1 lines 37- 
45 of Russell-Falla). 
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49. With respect to Claim 13, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches the computer network is a local area network (Col. 5 lines 50- 
67 of Trcka). 

50. With respect to Claim 15, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches said subject matter categories comprise key words (Col. 3 lines 
1-9 of Russell-Falla). 

51 . With respect to Claim 16, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 15 and further teaches wherein at least some of said key words are defined by the 
user (Col. 2 lines 30-36 and Col. 4 lines 45-60 of Russell-Falla). 

52. With respect to Claim 17, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches assigning a threshold value to each subject matter category 
(Col. 5 lines 47-64 of Russell-Falla). 

53. With respect to Claim 18, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 17 and further teaches at least some of said subject matter categories comprise one 
or more predetermined expressions (Col. 3 lines 36-51 of Russell-Falla). 

54. With respect to Claim 19, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 18 and further teaches assigning a value to said predetermined expressions (Col. 3 
lines 59-66 of Russell-Falla). 

55. With respect to Claim 20, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 19 and further teaches summing the values of said predetermined expressions (Col. 
3 line 60 - Col. 4 line 3 of Russell-Falla). 

56. With respect to Claim 21 , Russell-Falla in view of Trcka teaches all the limitations of 
Claim 20 and further teaches said communication is further stored if the sum of values of 
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said predetermined expressions comprising a subject matter category equal or exceed the 
threshold value assigned to said subject matter category (Col. 5 lines 47-64 and Col. 6 lines 
29-34 of Russell-Falla). 

57. With respect to Claim 23, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 21 and further teaches said threshold values assigned to said subject matter 
categories are variable (Col. 5 liens 47-64 of Russell-Falla). 

58. With respect to Claim 27, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 1 and further teaches outputting a report relating to the presence of said at least one 
preselected criterion (Col. 6 lines 29-34 of Russell-Falla). 

59. With respect to Claim 28, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 27 and further teaches said report identifies individuals whose use of the computer 
network included communications which matched preselected criterion (Col. 6 line 29-34, 
note the functionality of the report in Russell-Falla in view of Trcka is tied to a user - Col. 6 
lines 15-21 of Russell-Falla). 

60. With respect to Claim 29, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 27 and further teaches said report identifies network addresses where 
communications were received or originated that included matched preselected criterion 
(Col. 6 lines 29-34 of Russell-Falla). 

61 . With respect to Claim 32, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 27 and further teaches said report provides the text of all communications that match 
said preselected criterion (Col. 6 lines 29-34 of Russell-Falla). 
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62. With respect to Claim 33, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 27 and further teaches said report is human readable format (Col. 6 lines 29-34 of 
Russell-Falla). 

63. Claims 30 and 31 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Russell-Falla in view of Trcka. 

64. With respect to Claim 30, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches outputting a report relating to the presence of preselected 
criterion (Col. 6 lines 29-34 and Col. 9 lines 1-8 of Russell-Falla). Russell-Falla in view of 
Trcka does not explicitly disclose the report identifying the number of matches in a category. 
However, it is implied by Russell-Falla in view of Trcka that the report would indicate the 
number matches in a category as suggested by the alternate embodiments which provide 
for filing references of the content of concern and storing a presentation schema (Col. 8 line 
30 - Col. 9 line 15 of Russell-Falla). Furthermore, the reviewer such as the administrator 
(Col. 6 lines 29-34 of Russell-Falla) would need some indication as to the significance of the 
report in terms of evaluating the content. Therefore it would have been obvious to one of 
ordinary skill in the art at the time the invention was made to take the method disclosed by 
Russell-Falla in view of Trcka and modify it such that said report identifies the number of 
matches in a category. One would be motivated to have this as there is need for 
monitoring what persons such as employees access through a computer network (Col. 2 
lines 24-44 of Russell-Falla). 
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65. With respect to Claim 31 , Russell-Falla teaches all the limitations of Claim 30 and 
further teaches said report is in a graphical format (Col. 6 lines 29-34 and Col. 9 line 1-8 of 
Russell-Falla). 

66. Claims 36, 51 and 59 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Russell-Falla. 

67. With respect to Claim 36, Russell-Falla teaches all the limitations of Claim 34. While 
Russell-Falla does not explicitly state the computer network is a local area network, Russell- 
Falla does state the invention is well suited for monitoring those who have managerial 
responsibility for material accessed or retrieved by others such as employees (Col. 2 lines 
30-36). This implies the computer network environment would include a local area network 
such as those associated with work environments. It would have been obvious to one of 
ordinary skill in the art at the time the invention was made to take the method disclosed by 
Russell-Falla and modify it such that the computer network is a local area network. One 
would be motivated to have this as there is need for monitoring what persons such as 
employees access through a computer network (Col. 2 lines 24-44). 

68. With respect to Claim 51 , Russell-Falla teaches all the limitations of Claim 34 and 
further teaches outputting a report relating to the presence of predetermined expressions 
(Col. 6 lines 29-34 and Col. 9 lines 1-8). Russell-Falla does not explicitly disclose the report 
identifying the number of matches in a category. However, it is implied by Russell-Falla that 
the report would indicate the number matches in a category as suggested by the alternate 
embodiments which provide for filing references of the content of concern and storing a 
presentation schema (Col. 8 line 30 - Col. 9 line 15). Furthermore, the reviewer such as 
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the administrator (Col. 6 lines 29-34) would need some indication as to the significance of 
the report in terms of evaluating the content. Therefore it would have been obvious to one 
of ordinary skill in the art at the time the invention was made to take the method disclosed 
by Russell-Falla and modify it such that said report identifies the number of matches in a 
category. One would be motivated to have this as there is need for monitoring what 
persons such as employees access through a computer network (Col. 2 lines 24-44). 

69. With respect to Claim 59, Russell-Falla teaches all the limitations of Claim 55. While 
Russell-Falla does not explicitly state the computer network is a local area network, Russell- 
Falla does state the invention is well suited for monitoring those who have managerial 
responsibility for material accessed or retrieved by others such as employees (Col. 2 lines 
30-36). This implies the computer network environment would include a local area network 
such as those associated with work environments. It would have been obvious to one of 
ordinary skill in the art at the time the invention was made to take the method disclosed by 
Russell-Falla and modify it such that the computer network is a local area network. One 
would be motivated to have this as there is need for monitoring what persons such as 
employees access through a computer network (Col. 2 lines 24-44). 

70. Claims 8-10, 14, 22 and 24-26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Russell-Falla in view of Trcka and in further view of U.S. Patent 
6,366,910 by Rajaraman et al. (Rajaraman). 

71 . With respect to Claim 8, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 7 but does not explicitly disclose regular expressions with negative values being 
before regular expressions with positive value. Rajaraman teaches regular expressions 
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with negative values are before regular expression with positive values (Col. 7 lines 37-45 
and Col. 9 lines 19-28). It would have been obvious to one of ordinary skill in the art at the 
time the invention was made to take the method disclosed by Russell-Falla in view of Trcka 
and modify it as indicated by Rajaraman such that regular expressions within a subject 
matter category having a negative value are before regular expressions having a positive 
value. This aids in accurately identifying the content by reducing irrelevant hits (Col. 7 lines 
22-42 of Rajaraman). One would be motivated to have this as there is need for accurately 
and efficiently identifying a category for which content belongs (Col. 2 lines 19-56 of 
Russell-Falla). 

72. With respect to Claim 9, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 4 but does not explicitly disclose prioritizing the order which regular expressions 
within a subject matter category are tested. Rajaraman teaches prioritizing the order which 
regular expressions within a subject matter category are tested (Col. 9 lines 19-28). It 
would have been obvious to one of ordinary skill in the art at the time the invention was 
made to take the method disclosed by Russell-Falla in view of Trcka and modify it as 
indicated by Rajaraman such that it further comprises prioritizing the order which regular 
expressions within a subject matter category are tested. This aids in accurately identifying 
the content by reducing irrelevant hits (Col. 7 lines 22-42 of Rajaraman). One would be 
motivated to have this as there is need for accurately and efficiently identifying a category 
for which content belongs (Col. 2 lines 19-56 of Russell-Falla). 

73. With respect to Claim 10, Russell-Falla in view of Trcka and in further view of 
Rajaraman teaches all the limitations of Claim 9 and further teaches said prioritizing 
reduces likelihood of false hits (Col. 7 lines 22-42 of Rajaraman). 
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74. With respect to Claim 14, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 2 and further teaches preselected criterion (Col. 3 lines 1-8) and a plurality of 
categories (Col. 4 lines 45-60). Russell-Falla in view of Trcka does not explicitly disclose a 
presence being a match in a plurality of categories. Rajaraman teaches the presence being 
a match in a plurality of categories (Col. 10 lines 22-34). It would have been obvious to one 
of ordinary skill in the art at the time the invention was made to take the method disclosed 
by Russell-Falla in view of Trcka and modify it as indicated by Rajaraman such that the 
presence of the preselected criterion in at least one of said categories comprises a match in 
a plurality of categories. One would be motivated to have this as there is need for 
accurately and efficiently identifying a category for which content belongs (Col. 2 lines 19-56 
of Russell-Falla). ' 

75. With respect to Claim 22, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 21 and further teaches threshold values for subject matter categories (Col. 5 lines 47- 
63) and a plurality of subject matter categories (Col. 4 lines 45-60). Russell-Falla in view of 
Trcka does not explicitly disclose a threshold for one category equaling or exceeding the 
threshold value in a plurality of categories. Rajaraman teaches a threshold for one category 
equaling or exceeding the threshold value in a plurality of categories (Col. 10 lines 22-34). 

It would have been obvious to one of ordinary skill in the art at the time the invention was 
made to take the method disclosed by Russell-Falla in view of Trcka and modify it as 
indicated by Rajaraman such that the threshold value of at least one subject matter 
category comprises equaling or exceeding the threshold value in a plurality of categories. 
One would be motivated to have this as there is need for accurately and efficiently 
identifying a category for which content belongs (Col. 2 lines 19-56 of Russell-Falla). 
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76. With respect to Claim 24, Russell-Falla in view of Trcka teaches all the limitations of 
Claim 18 but does not explicitly disclose the subject matter categories having a hierarchical 
relationship. Rajaraman teaches that subject matter categories can have a hierarchical 
relationship (Col. 10 lines 22-34). It would have been obvious to one of ordinary skill in the 
art at the time the invention was made to take the method disclosed by Russell-Falla in view 
of Trcka and modify it as indicated by Rajaraman such that said subject matter categories 
have a hierarchical relationship. One would be motivated to have this as there is need for 
accurately and efficiently identifying a category for which content belongs (Col. 2 lines 19-56 
of Russell-Falla). 

77. With respect to Claim 25, Russell-Falla in view of Trcka and in further view of 
Rajaraman teaches all the limitations of Claim 24 and further teaches said hierarchical 
relationship comprises defining the threshold value for at least one subject matter category 
as the presence of predetermined expressions in a plurality of other subject matter 
categories (Col. 10 lines 22-34 of Rajaraman). 

78. With respect to Claim 26, Russell-Falla in view of Trcka and in further view of 
Rajaraman teaches all the limitations of Claim 24 and further teaches said hierarchical 
relationship comprises defining the threshold value for at least one subject matter category 
as matching or exceeding the threshold value assigned to a plurality of other subject matter 
categories (Col. 10 lines 22-34 of Rajaraman). 

79. Claims 40-43, 45, 46 and 56 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Russell-Falla in view of Rajaraman. 
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80. With respect to Claim 40, Russell-Falla teaches all the limitations of Claim 39 but 
does not explicitly disclose prioritizing the order which regular expressions within a subject 
matter category are tested. Rajaraman teaches prioritizing the order which regular 
expressions within a subject matter category are tested (Col. 9 lines 19-28). It would have 
been obvious to one of ordinary skill in the art at the time the invention was made to take 
the method disclosed by Russell-Falla and modify it as indicated by Rajaraman such that it 
further comprises prioritizing the order which regular expressions within a subject matter 
category are tested. This aids in accurately identifying the content by reducing irrelevant 
hits (Col. 7 lines 22-42 of Rajaraman). One would be motivated to have this as there is need 
for accurately and efficiently identifying a category for which content belongs (Col. 2 lines 
19-56 of Russell-Falla). 

81 . With respect to Claim 41 , Russell-Falla in view of Rajaraman teaches all the 
limitations of Claim 40 and further teaches the negative values regular expressions are 
tested first (Col. 9 lines 1 9-28). 

82. With respect to Claim 42, Russell-Falla in view of Rajaraman teaches all the 
limitations of Claim 41 and further teaches said negative and positive valued regular 
expressions are separately tested in the order of largest value to smallest value (Col. 9 lines 
19-45). 

83. With respect to Claim 43, Russell-Falla in view of Rajaraman teaches all the 
limitations of Claim 40 and further teaches said prioritizing is determined based upon 
reducing likelihood of false hits (Col. 7 lines 22-42 of Rajaraman). 

84. With respect to Claim 45, Russell-Falla teaches all the limitations of Claim 21 and 
further teaches threshold values for categories (Col. 5 lines 47-63) and a plurality of 
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categories (Col. 4 lines 45-60). Russell-Falla does not explicitly disclose a threshold for one 
category meeting or exceeding the threshold value for a plurality of other categories. 
Rajaraman teaches a threshold for one category equaling or exceeding the threshold value 
in a plurality of categories (Cot. 10 lines 22-34). It would have been obvious to one of 
ordinary skill in the art at the time the invention was made to take the method disclosed by 
Russell-Falla and modify it as indicated by Rajaraman such that the threshold value for at 
least one category comprises meeting or exceeding the threshold value in a plurality of 
categories. One would be motivated to have this as there is need for accurately and 
efficiently identifying a category for which content belongs (Col. 2 lines 19-56 of Russell- 
Falla). 

85. With respect to Claim 46, Russell-Falla teaches all the limitations of Claim 34 but 
does not explicitly.disclose the threshold value of at least one category comprises meeting 
or exceeding the threshold value for at least one other category and not meeting or 
exceeding the threshold value for at least another category. Rajaraman teaches the 
threshold value of at least one category comprises meeting or exceeding the threshold 
value for at least one other category and not meeting or exceeding the threshold value for at 
least another category (Col. 10 lines 22-34). It would have been obvious to one of ordinary 
skill in the art at the time the invention was made to take the method disclosed by Russell- 
Falla and modify it as indicated by Rajaraman such that the threshold value of at least one 
category comprises meeting or exceeding the threshold value for at least one other 
category and not meeting or exceeding the threshold value for at least another category. 
One would be motivated to have this as there is need for accurately and efficiently 
identifying a category for which content belongs (Col. 2 lines 19-56 of Russell-Falla). 
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86. With respect to Claim 56, Russell-Falla teaches all the limitations of Claim 21 and 
further remaining data being stored based on the sum of predetermined expressions (Col. 3 
line 56 - Col. 4 line 3). Russell-Falla does not explicitly disclose storing of the remaining 
data occurring only if the sum of predetermined expressions exceeds the threshold value in 
a plurality of categories. Rajaraman teaches a threshold for a plurality of categories (Col. 
10 lines 22-34). It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to take the method disclosed by Russell-Falla and modify it as 
indicated by Rajaraman such that said remaining data is stored only if the sum of 
predetermined expressions exceeds the threshold value in a plurality of categories. One 
would be motivated to have this as there is need for accurately and efficiently identifying a 
category for which content belongs (Col. 2 lines /1 9-56 of Russell-Falla). 

Response to Arguments 

87. Applicant's arguments filed 10/18/04 have been fully considered but they are not 
persuasive. 

88. Applicant argues (pages 1 1-12 of remarks) - "...The invention of claim 1 is able to 
process web pages, email, file transfer protocol (FTP), or other unknown protocols because 
it monitors communication at a transport level.... In contrast, Russell-Falla teaches a 
system that monitors communication at the application layer, which would be necessary to 
monitor an HTML web page or email" 

a. It is interesting to note that Applicant asserts that monitoring a web page or 

email would necessarily require monitoring communication at the application layer 
after just stating the invention of claim was can process web pages and email 
because it monitors communication at a transport level. It would seem as if one 
could make the argument, then, that Russell-Fall also monitors communications at a 
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transport level. In any case, this argument is not persuasive and is rendered moot 
based on the rejection of Claim 1 based on the combination of Russell-Falla in view 
Trcka. 

89. Applicant argues (page 1 2) - "Claim 1 further calls for the testing to be performed 
against "at least one preselected criterion". Russell-Falla et al. do not show using criterion 
that are preselected. Instead, the criteria in Russell-Falla are determined by a neural 
network based on analysis of selected web pages, not any process that directly preselects 
the criterion" Applicant makes similar arguments in regards to claim 34 on page 13. 

b. The examiner notes that the claim language does not state any process that 

"directly pre-selects the criterion". While the neural network of Russell-Fall is used in 
part to determine lists of words and weightings for a subject matter category (Col. 6 
lines 36-48), the examiner does not see how this has any bearing on the meaning of 
"preselected criterion". Col. 5, 5-12, specifically states, "The first analysis step 14 
calls for scanning the page to identify the regular expressions, such as natural 
language textual portions of the page. For each expression, the software queries a 
pre-existing database 30 to determine whether or not the expression appears in the 
database. "(emphasis added). If there is a pre-existing database that stores the 
expression (criterion) being tested for, then that criterion is preselected. 

90. Applicant argues (pages 12-13 of remarks) - "Further, claims 2-4, 6-10 and 14- 26 
call for the preselected criterion to comprise one or more subject matter categories. The 
relied on portion of Russell-Falla (Column 4, lines 45-60) teaches against the use of 
categories as called for in the instant claims. Russell-Falla teaches the detection for a 
"specific type of selected content", detecting content "about a particular religion or a 
particular book", and the like. Hence, although Russell-Falla use the word "category", it is 
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clear that they only contemplate a single category of information for any particular instance 
of their application. In contrast, the present invention contemplates the use of plural 
categories which overcomes the limitation that is explicit in Russell-Falla to a "specific type", 
"particular religion " or "particular book". 

And also on pages 13-14 of remarks - ''Claim 55 calls for, among other things, "defining 
categories with weighted predetermined expressions" (emphasis added) and "maintaining a 
sum of values associated with said predetermined expressions found within each category. " 
These features of claim 55 are not shown or suggested in the relied on reference. As noted 
hereinbefore, Russell-Falla only contemplate a single category for a particular instance of 
their application. " 

c. The examiner first notes that claim 2 states, "wherein the preselected criterion 
comprises one or more subject matter categories". As such, the invention as 
claimed is not limited to the use of plural categories and may only have one subject 
matter category. As such, even by the Applicant's interpretation of Russell-Falla, the 
teachings of Russell-Falla are within the scope of the claim limitations for claim 2 
and the associated dependents. 

d. However, the examiner disagrees with Applicant's interpretation of Russell- 
Falla. Nowhere in Russell-Falla, is there an indication or suggestion that one making 
and using the invention of Russell-Fall would be restricted to analysis and detection 
of content in only one category. For example, the Applicant states several different 
applications for the Russell-Falla as evidence of restriction to a single category. On 
the contrary, nothing in that section (Col. 4 lines 45-60) states that only one category 
can be applied for "any particular instance of their application". Based on the 
teachings and most importantly, the underlying principles of the invention (Col. 9 
lines 9-12) of Russell-Falla, one of ordinary skill in the art would easily understand 
that the analysis and detection process disclosed by Russell-Falla could be repeated 
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on the same set of data for any selected category. Obviously, if one is concerned 
about the various forms of data that can be encountered in a information network 
environment (Col. 2 lines 24-36), then one would not restrict or limit the detection 
process to a single form (a single category). As such, the Applicants arguments are 
not persuasive. 

91 . Applicant argues (page 13 of remarks) - "...Russell-Fall teaches a system that 
monitors communication at the application layer, which would be necessary to monitor an 
HTML web page or email. Russell-Falla do not show or suggest capturing data comprising 
multiple half sessions of transport layer network communications" 

e. The examiner notes the claim language states "capturing data on a network". 

Russell-Falla teaches capturing of data on a network in the form of a web page in 
one embodiment (Col. 4 line 61 - Col. 5 line 21). The claim further recites, "wherein 
the data comprises multiple half sessions of transport layer network 
communications". It is inherent that any network communication data on a network 
such as the Internet/Web (col. 4 line 61 - Col. 5 line 21 and Col. 1 lines 37-45) would 
comprise multiple half sessions of transport layer network communications. While 
Russell-Falla may not explicitly disclose monitoring implementations at any particular 
network layer, this is not claimed. Furthermore, regardless to the network layer 
being monitored, the network data is not precluded from having transport layer 
properties. 

92. Applicant argues (page 1 3 of remarks) - "Nothing in Russell-Fall shows or suggest 
the use of categories nor maintaining a sum of values on a category basis as called for in 
claim 34." 
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f. The examiner notes the claim language does not state the use of categories. 
The claim states "maintaining a sum of values associated with said predetermined 
expressions found within at least one category "(emphasis added). Examiner has 
already addressed the issue of one category versus plural categories. In regards to 
the "maintaining a sum of values", Col. 3 line 65 - Col. 4 line 3 states in part, "Thus, 
when the weightings are summed in calculating a rating of a page, the higher the 
value the more likely the page meets the selected criterion. "(emphasis added). The 
weightings are directly related to the predetermined expressions of a category. This 
is clearly within the scope of the claim limitation. Furthermore, Applicants only 
provide a conclusive statement without asserting factual evidence or errors with the 
examiner's interpretation of the art. As such, Applicant's arguments are not 
persuasive. 

93. Applicant grgues (page 1 3 of remarks) - "Further, claim 55 calls for storing the 
remaining data if the sum of values associated with said predetermined expressions present 
within a category exceeds a threshold value. Russell-Falla do not show or suggest storing 
any data, only forwarding the data to an administrator 11 

g. The examiner notes that aspart of the entire testing process, it is inherent 

that the data is stored in some manner. Data can't be manipulated and analyzed 
(Col. 5 lines 5-1 1 , Col. 3 line 36 - Col. 4 line 3) without being stored in some 
manner. While the type of storage is not explicitly stated in Russell-Falla, the claims 
do note define any limitations on a type of storage as opposed to Claim 1 . 
Furthermore, as stated by applicant, the data is forwarded to an administrator where 
it is subsequently reviewed by the administrator (Col. 6 line 29-34). In order to 
receive and subsequently review the data, a web page in this case, the data would 
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have to be stored in some manner. Therefore, the teachings of Russell-Falla do 
show storage of data and are within the scope of the claimed limitations. 

94. Applicant argues (page 14 of remarks) - "Further, with respect to claims 13, 30 and 
51, Russell-Falla does not show or suggest a report of any kind, and certainly does not 
show or suggest a graphical report of claim 31. The mere mention of a notification in 
Russell-Falla does not fairly suggest a report called for in the claims" 

h. Applicant does not provide any reasoning as to why a notification does not 

fairly suggest a report. The examiner asserts that a notification is a form of reporting 
that would be within the scope the claims. If the administrator is capable of 
reviewing the page in question as a result of the notification (Col. 6 lines 29-34) then 
the notification and further the actual review of the page serve the function of a 
report. Since the administrator must be notified of the page in order to view the 
page, then the report must be a graphical report. While the details of such a 
graphical display of a report are not disclosed, the claim language does not state any 
limitations in regards to the appearance of or information included in the report. 

95. Applicant argues (page 14 of remarks) - "It is noted that claim 37 calls for a TCP/IP 
network with respect to which the Office action fails to state any rejection. " 

i. The Office Action includes a typo that resulted in claims 35-37 being out of 

order. However, it is clear from the action that rejection was stated in regards to the 
limitation of claim 37 which mirrors the rejection of Claim 11. 
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96. Applicant argues (page 14 of remarks) - "Further, Rajaraman does not teach that the 
presence of the preselected criterion in at least one of said categories comprises a match in 
a plurality of categories". 

j. Applicant's arguments are merely conclusive and provide no reasoning or 

evidence in support thereof. Furthermore, one cannot show nonobviousness by 
attacking references individually where the rejections are based on combinations of 
references: See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re 
Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). 

Conclusion 

97. Applicant's* amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until 
after the end of the THREE-MONTH shortened statutory period, then the shortened 
statutory period will expire on the date the advisory action is mailed, and any extension fee 
pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. 
In no event, however, will the statutory period for reply expire later than SIX MONTHS from 
the date of this final action. 
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Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to David Lazaro whose telephone number is 571-272-3986. 
The examiner can normally be reached on 8:30-5:00 M-F. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Hosain Alam can be reached on 571-272-3978. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status information 
for unpublished applications is available through Private PAIR only. For more information 
about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866- 
217-9197 (toll-free). 
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